better-supabase 0.7.1 → 0.9.0

package/dist/edge/index.d.ts

@@ -1,11 +1,17 @@
-import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
-import { s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { f as Result } from "../result-Cj3yWhjH.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-YfwpIE-d.js";
+import { t as StandardSchemaV1 } from "../standard-C3_AAF3g.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { i as ServerContext, s as ServerOptions, t as BetterServer } from "../server-types-OohhIQb2.js";
+import { t as AuthSession } from "../view-Dv0A949a.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-C7I8kLK_.js";
+import { s as BlockRequireOptions } from "../kit-D5S7KNFe.js";
+import { n as FunctionContract, t as DescribedFunction } from "../function-contract-B4c0XuTU.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-D2vEQVXI.js";
+import { t as ResourceMap } from "../resources-BklF-rjz.js";
+import { t as defineAction } from "../resource-execute-D0yQ-8WR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { WithCorsConfig } from "@supabase/middleware/cors";
 //#region src/bridges/edge.d.ts
@@ -27,6 +33,50 @@ type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExec
  */
 export declare function toEdge<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, handler: (request: Request, ctx: Contributions<Entries>, executionContext: EdgeExecutionContext | undefined, env: unknown) => Response | Promise<Response>): EdgeHandler;
 //#endregion
+//#region src/edge/function.d.ts
+/** A fetch handler that carries its contract in its type and its schemas at runtime. */
+type TypedFunction<In, Out> = EdgeHandler & DescribedFunction & {
+  /** Type-only: never set at runtime. */
+  readonly "~contract"?: FunctionContract<In, Out>;
+};
+/**
+ * The contract of a `defineFunction` handler, for `functions<Contracts>()` in
+ * `better-supabase/client`.
+ */
+type ContractOf<T> = T extends TypedFunction<infer In, infer Out> ? FunctionContract<In, Out> : never;
+type Returned<Out> = Out | Result<Out> | Response | PromiseLike<Out | Result<Out> | Response> | undefined;
+interface FunctionDefinition<I extends StandardSchemaV1, Out, M extends AnyModels, F extends AnyFunctions, E, C, P> extends MiddlewareOptions {
+  /** Parses the JSON body. A body it rejects answers 422 with the issues. */
+  readonly input: I;
+  /**
+   * Checks what the handler returns before it is sent. A value it rejects
+   * answers 500, so a function never sends data its contract doesn't promise.
+   */
+  readonly output?: StandardSchemaV1<unknown, Out>;
+  /** A one-line summary for the operation `functionRoute` describes in `better-supabase/spec`. */
+  readonly summary?: string;
+  /** Runs as the caller with the parsed input. Returns data or a `Result`. */
+  readonly handler: (input: StandardSchemaV1.InferOutput<I>, ctx: ServerContext<M, F, E, C, P> & {
+    readonly request: Request;
+  }) => Returned<Out>;
+}
+/**
+ * An Edge Function with a typed input and output: the body is parsed and
+ * checked with a Standard Schema (zod, valibot, arktype, ...) before the
+ * handler runs as the caller. Its type carries the contract, so the app calls
+ * it through `functions<Contracts>()` from `better-supabase/client`.
+ *
+ * ```ts
+ * const sendInvite = defineFunction(bs, {
+ *   input: z.object({ email: z.email() }),
+ *   handler: (input, ctx) => ctx.db.invites.create({ data: input }),
+ * });
+ * export type SendInvite = ContractOf<typeof sendInvite>;
+ * Deno.serve(sendInvite);
+ * ```
+ */
+export declare function defineFunction<I extends StandardSchemaV1, Out, M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown>(edge: Pick<BetterEdge<M, F, E, C, P>, "handler">, definition: FunctionDefinition<I, Out, M, F, E, C, P>): TypedFunction<StandardSchemaV1.InferInput<I>, Out>;
+//#endregion
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */
@@ -48,7 +98,6 @@ export interface EdgeOptions extends ServerOptions {
    */
   readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
-export type ResourceMap<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
 export interface ResourcesOptions extends MiddlewareOptions {
   /** Path before the resources, e.g. `/api` (Supabase: `/<function-name>`). */
   readonly basePath?: string;
@@ -75,7 +124,7 @@ export interface EdgeRoute<M extends AnyModels, F extends AnyFunctions, E, C = u
  * segments are params, a final `*` matches the rest of the path.
  */
 export type EdgeRoutes<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = Readonly<Record<string, EdgeRouteHandler<M, F, E, C, P> | EdgeRoute<M, F, E, C, P>>>;
-export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends BetterServer<M, F, E, C, P> {
   /**
    * A fetch handler (`Deno.serve`, Workers `fetch`) running as the caller.
    * `Result`s become JSON or Problem Details; `undefined` becomes 204.
@@ -96,13 +145,19 @@ export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C =
    * ```
    */
   routes<K extends string>(routes: { readonly [Key in K]: EdgeRouteHandler<M, F, E, C, P, RouteParams<Key>> | EdgeRoute<M, F, E, C, P, RouteParams<Key>>; }, options?: ResourcesOptions): EdgeHandler;
-  /** REST resources matching `createOpenApi`, e.g. `Deno.serve(bs.resources({ customers: true }))`. */
-  resources(map: ResourceMap<M>, options?: ResourcesOptions): EdgeHandler;
+  /**
+   * REST resources matching the API model, e.g.
+   * `Deno.serve(bs.resources({ customers: true }))`: collection, item and
+   * action paths. An unknown path answers 404 before auth resolves.
+   */
+  resources(map: ResourceMap<M, Ref, ServerContext<M, F, E, C, P>["db"]>, options?: ResourcesOptions): EdgeHandler;
 }
 export declare const SUPABASE_CORS_HEADERS: readonly string[];
 /** `CorsOptions` as `withCors` from `@supabase/middleware/cors` takes them. */
 export declare function corsConfig(cors: CorsOptions): WithCorsConfig;
 /** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
-export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: EdgeOptions): BetterEdge<M, F, E, C, P>;
+export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: EdgeOptions & {
+  readonly authorizer?: A;
+}): BetterEdge<M, F, E, C, P, PermissionRef<A>>;
 //#endregion
-export type { BlockRequireOptions, EdgeExecutionContext, EdgeHandler, GuardOptions, MiddlewareOptions, ResourceRouteOptions };
+export { type ActionArgs, type BlockRequireOptions, type ContractOf, type EdgeExecutionContext, type EdgeHandler, type FunctionContract, type FunctionDefinition, type GuardOptions, type MiddlewareOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceMap, type ResourceRouteOptions, type TypedFunction, defineAction };

package/dist/edge/index.js

@@ -1,12 +1,16 @@
-import { n as dbError } from "../errors-B11Duf73.js";
-import { r as err } from "../result-DzUbqgdW.js";
-import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
-import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-DXVUibdi.js";
-import { t as defineResource } from "../resource-BsvzCMlX.js";
-import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
-import { t as EVERY_CALLER } from "../framework-a7aRCIqv.js";
+import { n as dbError } from "../errors-8i6tSICm.js";
+import { a as ok, r as err } from "../result-BlgnMB0H.js";
+import { n as validate } from "../standard-B5fe2gnW.js";
+import { o as problemResponse } from "../problem-pIiL3WbE.js";
+import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-CEjmtazZ.js";
+import { a as respond, o as settle, t as defaultExpose } from "../respond-DdhZ9Wbn.js";
+import { t as withBetterSupabase } from "../composite-M6zPs1Xm.js";
+import { r as defineAction } from "../resource-C8r5xGqY.js";
+import { i as requireCaller } from "../kit-MUK34-ZG.js";
+import { t as withExtra } from "../extra-CGQ2_q3S.js";
+import { n as resourceRouter } from "../resources-BlZdLsWQ.js";
+import { t as EVERY_CALLER } from "../framework-INbjMZX1.js";
+import { t as FUNCTION_DESCRIPTOR } from "../function-contract-DmkBg19r.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts
@@ -60,7 +64,7 @@ function compileRoutes(routes) {
 	return compiled.toSorted((a, b) => weight(a) - weight(b));
 }
 function paramsOf(segments, rest, parts) {
-	if (rest ? parts.length < segments.length : parts.length !== segments.length) return void 0;
+	if (rest ? parts.length < segments.length : parts.length !== segments.length) return;
 	const params = {};
 	for (const [index, segment] of segments.entries()) {
 		const part = parts[index] ?? "";
@@ -69,7 +73,7 @@ function paramsOf(segments, rest, parts) {
 		} catch {
 			return;
 		}
-		else if (segment !== part) return void 0;
+		else if (segment !== part) return;
 	}
 	if (rest) params["*"] = parts.slice(segments.length).join("/");
 	return params;
@@ -99,6 +103,54 @@ function matchRoute(routes, method, path) {
 	return allowed.size > 0 ? [...allowed] : "none";
 }
 //#endregion
+//#region src/edge/function.ts
+async function readInput(request) {
+	if (request.method === "GET" || request.method === "HEAD") return ok(void 0);
+	const text = await request.text();
+	if (text === "") return ok(void 0);
+	try {
+		return ok(JSON.parse(text));
+	} catch {
+		return err(dbError("invalid_input", "The request body is not JSON"));
+	}
+}
+/**
+* An Edge Function with a typed input and output: the body is parsed and
+* checked with a Standard Schema (zod, valibot, arktype, ...) before the
+* handler runs as the caller. Its type carries the contract, so the app calls
+* it through `functions<Contracts>()` from `better-supabase/client`.
+*
+* ```ts
+* const sendInvite = defineFunction(bs, {
+*   input: z.object({ email: z.email() }),
+*   handler: (input, ctx) => ctx.db.invites.create({ data: input }),
+* });
+* export type SendInvite = ContractOf<typeof sendInvite>;
+* Deno.serve(sendInvite);
+* ```
+*/
+function defineFunction(edge, definition) {
+	const { input, output, summary, handler, ...options } = definition;
+	const fn = edge.handler(async (request, ctx) => {
+		const body = await readInput(request);
+		if (!body.ok) return body;
+		const parsed = await validate(input, body.data, "input");
+		if (!parsed.ok) return parsed;
+		const settled = await settle(() => handler(parsed.data, withExtra(ctx, { request })));
+		if (!settled.ok) return err(settled.error);
+		if (output === void 0 || settled.data instanceof Response) return settled.data;
+		const checked = await validate(output, settled.data, "output");
+		return checked.ok ? checked.data : err(dbError("unexpected", "The function returned data its output rejects"));
+	}, options);
+	const descriptor = {
+		input,
+		...output ? { output } : {},
+		...summary === void 0 ? {} : { summary }
+	};
+	Object.defineProperty(fn, FUNCTION_DESCRIPTOR, { value: descriptor });
+	return fn;
+}
+//#endregion
 //#region src/edge/index.ts
 const SUPABASE_CORS_HEADERS = [
 	"authorization",
@@ -147,11 +199,7 @@ function createEdge(betterSupabase, options = {}) {
 		});
 		const routed = (request, env, executionContext) => Promise.resolve(early?.(request) ?? authorized(request, env, executionContext));
 		const answer = withCorsConfig ? toEdge([withCors(withCorsConfig)], (request, _ctx, executionContext, env) => routed(request, env, executionContext)) : routed;
-		return async (request, env, executionContext) => {
-			const response = await answer(request, env, executionContext);
-			flushEvents(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext));
-			return response;
-		};
+		return async (request, env, executionContext) => withFlush(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext), () => answer(request, env, executionContext));
 	};
 	return extendServer(server, {
 		handler(fn, handlerOptions = {}) {
@@ -193,7 +241,7 @@ function createEdge(betterSupabase, options = {}) {
 				const caller = await requireCaller(ctx.auth, {
 					...shared,
 					...route.options
-				}, tenant);
+				}, tenant, options.authorizer);
 				if ("kind" in caller) return err(caller);
 				return route.handler(request, withExtra(ctx, {
 					params,
@@ -209,40 +257,24 @@ function createEdge(betterSupabase, options = {}) {
 			});
 		},
 		resources(map, resourcesOptions = {}) {
-			const base = (resourcesOptions.basePath ?? "").replace(/\/$/, "");
-			const handlers = /* @__PURE__ */ new Map();
-			for (const [table, resource] of Object.entries(map)) {
-				if (!resource) continue;
-				handlers.set(table, defineResource(betterSupabase, table, resource === true ? {} : resource));
-			}
-			const match = (request) => {
-				const { pathname } = new URL(request.url);
-				const [table, id, extra] = (pathname.startsWith(`${base}/`) ? pathname.slice(base.length + 1) : void 0)?.split("/") ?? [];
-				const handler = table ? handlers.get(table) : void 0;
-				if (!handler || extra !== void 0 || id !== void 0 && !handler.keyParam) return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance: pathname });
-				try {
-					return {
-						handler,
-						id: id === void 0 || id === "" ? void 0 : decodeURIComponent(id),
-						instance: pathname
-					};
-				} catch {
-					return problemResponse(dbError("invalid_input", `Malformed id in ${pathname}`), { instance: pathname });
-				}
-			};
+			const { basePath, ...middlewareOptions } = resourcesOptions;
+			const router = resourceRouter(betterSupabase, map, {
+				...basePath === void 0 ? {} : { basePath },
+				...options.authorizer === void 0 ? {} : { authorizer: options.authorizer }
+			});
 			return serve((request, ctx) => {
-				const route = match(request);
+				const route = router.match(request);
 				if (route instanceof Response) return route;
-				return route.handler.handle(request, ctx.db, route.id, {
+				return route.handler.serve(request, ctx.db, route.segments, {
 					instance: route.instance,
 					expose
 				});
-			}, resourcesOptions, (request) => {
-				const route = match(request);
+			}, middlewareOptions, (request) => {
+				const route = router.match(request);
 				return route instanceof Response ? route : void 0;
 			});
 		}
 	});
 }
 //#endregion
-export { SUPABASE_CORS_HEADERS, corsConfig, createEdge, toEdge };
+export { SUPABASE_CORS_HEADERS, corsConfig, createEdge, defineAction, defineFunction, toEdge };

package/dist/elysia/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
+import { n as RouteGuardOptions } from "../refusal-oD3ISM9h.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts

package/dist/elysia/index.js

@@ -1,5 +1,5 @@
-import { t as around } from "../shared-CBxosKK3.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
+import { t as around } from "../shared-BmMcMoW9.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-br4Ma9Cf.js";
 import { bufferRequest } from "@supabase/middleware";
 //#region src/bridges/elysia.ts
 /**

package/dist/email-BcmbIWOX.d.ts

@@ -0,0 +1,42 @@
+import { n as NotificationMessage, t as NotificationChannel } from "./channel-D-LHCY11.js";
+import { a as DeliveryTransport, c as UnsubscribeTarget, s as MailCategory } from "./delivery-BeHgwS3k.js";
+//#region src/blocks/notifications/email.d.ts
+/** The mail for one delivery. */
+interface ComposedEmail {
+  readonly subject: string;
+  readonly text?: string;
+  readonly html?: string;
+  readonly replyTo?: string;
+  /** Defaults to `notification`. */
+  readonly category?: MailCategory;
+  /**
+   * Names the template this mail came from, e.g. `task-assigned-v2`. The
+   * delivery keeps it, so a record's sent emails show which one went out.
+   */
+  readonly templateKey?: string;
+}
+interface EmailChannelOptions {
+  readonly transport: DeliveryTransport;
+  /** `Name <address>` or an address the provider has verified. */
+  readonly from: string;
+  readonly replyTo?: string;
+  /**
+   * The mail for a delivery. Defaults to the rendered title as the subject
+   * and the rendered body (or the title) as the text, so it needs
+   * `createNotifications({ render })`.
+   */
+  readonly compose?: (message: NotificationMessage) => ComposedEmail | Promise<ComposedEmail>;
+  /**
+   * Where the reader unsubscribes from this mail, such as a signed link to
+   * your preferences route. Only `notification` mail carries it.
+   */
+  readonly unsubscribe?: (message: NotificationMessage) => UnsubscribeTarget | undefined | Promise<UnsubscribeTarget | undefined>;
+}
+/**
+ * A `NotificationChannel` named `email` that sends through `transport`,
+ * with the delivery id as the idempotency key. A recipient without an
+ * address is skipped.
+ */
+declare function emailChannel(options: EmailChannelOptions): NotificationChannel;
+//#endregion
+export { EmailChannelOptions as n, emailChannel as r, ComposedEmail as t };

package/dist/embeddings-C2S14foD.d.ts

@@ -0,0 +1,78 @@
+import { d as KnowledgeSearchOptions, n as Embedder, o as KnowledgeHit, r as Knowledge } from "./knowledge-BXQ2-V0a.js";
+import { EmbeddingModel, RerankingModel, SourceDocumentUIPart, Tool, embedMany } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.d.ts
+type ProviderOptions = Parameters<typeof embedMany>[0]["providerOptions"];
+interface EmbedWithOptions {
+  /** Concurrent calls when the values need more than one. Default 4. */
+  readonly maxParallelCalls?: number;
+  readonly providerOptions?: ProviderOptions;
+  /** The name stored with each embedding; the provider and model id by default. */
+  readonly name?: string;
+}
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+declare function modelName(model: string | {
+  readonly provider: string;
+  readonly modelId: string;
+}): string;
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+declare function embedWith(model: EmbeddingModel, options?: EmbedWithOptions): Embedder;
+type Reranker = (query: string, hits: readonly KnowledgeHit[], options?: {
+  readonly signal?: AbortSignal;
+}) => Promise<readonly KnowledgeHit[]>;
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+declare function rerankWith(model: RerankingModel, options?: {
+  readonly topN?: number;
+}): Reranker;
+/**
+ * Keeps the items of a search the caller may read. A tool applies it before
+ * anything else sees the items: the reranker, `onHits` and the model. A
+ * throw fails the tool call, so no items reach the model.
+ */
+type ResultsFilter<T, C = {
+  readonly query: string;
+}> = (items: readonly T[], context: C) => readonly T[] | PromiseLike<readonly T[]>;
+interface SearchToolOptions extends Omit<KnowledgeSearchOptions, "signal"> {
+  readonly description?: string;
+  /** Drops the hits the caller may not read, such as by a permission. */
+  readonly results?: ResultsFilter<KnowledgeHit>;
+  /** Reranks the hits before the model sees them. */
+  readonly rerank?: Reranker;
+  /** Called with the hits, to stream them as source parts. */
+  readonly onHits?: (hits: readonly KnowledgeHit[]) => void;
+}
+interface SearchToolResult {
+  readonly results: readonly {
+    readonly id: string;
+    readonly title: string;
+    readonly content: string;
+  }[];
+}
+/**
+ * A tool that searches the knowledge base as the caller. Each result id
+ * is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+ */
+declare function searchTool(knowledge: Knowledge, organizationId: string, options?: SearchToolOptions): Tool<{
+  query: string;
+}, SearchToolResult>;
+/** One `source-document` part per document among the hits, in hit order. */
+declare function toSourceParts(hits: readonly KnowledgeHit[]): SourceDocumentUIPart[];
+/** `Supabase.ai.Session` in Supabase Edge Functions, typed structurally. */
+interface SupabaseAiSession {
+  run(input: string, options: {
+    readonly mean_pool: boolean;
+    readonly normalize: boolean;
+  }): Promise<unknown>;
+}
+interface SupabaseEmbedOptions {
+  /** The built-in model. Default `gte-small` (384 dimensions). */
+  readonly model?: string;
+  /** A session to use instead of `new Supabase.ai.Session(model)`. */
+  readonly session?: SupabaseAiSession;
+}
+/**
+ * An `Embedder` over the model built into Supabase Edge Functions. Set the
+ * module's `dimensions` option to the model's size (384 for `gte-small`).
+ */
+declare function supabaseEmbed(options?: SupabaseEmbedOptions): Embedder;
+//#endregion
+export { SearchToolResult as a, embedWith as c, searchTool as d, supabaseEmbed as f, SearchToolOptions as i, modelName as l, Reranker as n, SupabaseAiSession as o, toSourceParts as p, ResultsFilter as r, SupabaseEmbedOptions as s, EmbedWithOptions as t, rerankWith as u };

package/dist/embeddings-CVeOoufZ.js

@@ -0,0 +1,128 @@
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { embedMany, jsonSchema, rerank, tool } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.ts
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+function modelName(model) {
+	return typeof model === "string" ? model : `${model.provider}/${model.modelId}`;
+}
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+function embedWith(model, options = {}) {
+	return {
+		apiVersion: 1,
+		model: options.name ?? modelName(model),
+		embed: async (values, embedOptions) => {
+			if (values.length === 0) return [];
+			const { embeddings } = await embedMany({
+				model,
+				values: [...values],
+				maxParallelCalls: options.maxParallelCalls ?? 4,
+				...options.providerOptions === void 0 ? {} : { providerOptions: options.providerOptions },
+				...embedOptions?.signal === void 0 ? {} : { abortSignal: embedOptions.signal }
+			});
+			return embeddings;
+		}
+	};
+}
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+function rerankWith(model, options = {}) {
+	return async (query, hits, rerankOptions) => {
+		if (hits.length <= 1) return hits;
+		const { ranking } = await rerank({
+			model,
+			query,
+			documents: hits.map((hit) => hit.content),
+			...options.topN === void 0 ? {} : { topN: options.topN },
+			...rerankOptions?.signal === void 0 ? {} : { abortSignal: rerankOptions.signal }
+		});
+		return ranking.flatMap((entry) => {
+			const hit = hits[entry.originalIndex];
+			return hit === void 0 ? [] : [{
+				...hit,
+				score: entry.score
+			}];
+		});
+	};
+}
+/**
+* A tool that searches the knowledge base as the caller. Each result id
+* is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+*/
+function searchTool(knowledge, organizationId, options = {}) {
+	const { description, results, rerank: reorder, onHits, ...search } = options;
+	return tool({
+		description: description ?? "Search the knowledge base for passages relevant to a query. Cite results by their id.",
+		inputSchema: jsonSchema({
+			type: "object",
+			properties: { query: {
+				type: "string",
+				description: "What to look for"
+			} },
+			required: ["query"],
+			additionalProperties: false
+		}),
+		execute: async ({ query }, { abortSignal }) => {
+			const found = await knowledge.search(organizationId, query, {
+				...search,
+				...abortSignal === void 0 ? {} : { signal: abortSignal }
+			});
+			if (!found.ok) throw new DbException(found.error);
+			const readable = results ? await results(found.data, { query }) : found.data;
+			const hits = reorder ? await reorder(query, readable, abortSignal === void 0 ? void 0 : { signal: abortSignal }) : readable;
+			onHits?.(hits);
+			return { results: hits.map((hit) => ({
+				id: sourceId(hit),
+				title: hit.title,
+				content: hit.content
+			})) };
+		}
+	});
+}
+const sourceId = (hit) => `${hit.documentId}#${String(hit.index)}`;
+/** One `source-document` part per document among the hits, in hit order. */
+function toSourceParts(hits) {
+	const seen = /* @__PURE__ */ new Set();
+	const parts = [];
+	for (const hit of hits) {
+		if (seen.has(hit.documentId)) continue;
+		seen.add(hit.documentId);
+		parts.push({
+			type: "source-document",
+			sourceId: sourceId(hit),
+			mediaType: "text/plain",
+			title: hit.title
+		});
+	}
+	return parts;
+}
+function supabaseSession(model) {
+	const Session = globalThis.Supabase?.ai?.Session;
+	if (typeof Session !== "function") throw new TypeError("supabaseEmbed runs in Supabase Edge Functions, where Supabase.ai.Session exists; pass session elsewhere");
+	return new Session(model);
+}
+/**
+* An `Embedder` over the model built into Supabase Edge Functions. Set the
+* module's `dimensions` option to the model's size (384 for `gte-small`).
+*/
+function supabaseEmbed(options = {}) {
+	const name = options.model ?? "gte-small";
+	let session = options.session;
+	return {
+		apiVersion: 1,
+		model: `supabase/${name}`,
+		embed: async (values) => {
+			session ??= supabaseSession(name);
+			const vectors = [];
+			for (const value of values) {
+				const output = await session.run(value, {
+					mean_pool: true,
+					normalize: true
+				});
+				if (!Array.isArray(output) || !output.every((x) => typeof x === "number")) throw new TypeError(`Supabase.ai.Session returned no vector for ${name}`);
+				vectors.push(output);
+			}
+			return vectors;
+		}
+	};
+}
+//#endregion
+export { supabaseEmbed as a, searchTool as i, modelName as n, toSourceParts as o, rerankWith as r, embedWith as t };

package/dist/ended-nIdGCHxk.d.ts

@@ -0,0 +1,70 @@
+import { m as RequestContext } from "./plugin-CDLJRFFg.js";
+import { g as StoredSession, r as AuthState, u as CookieOptions } from "./resolve-w9EpHzuM.js";
+//#region src/auth/refresh.d.ts
+interface RefreshOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  /**
+   * Sends `Sb-Forwarded-For: ip` with the secret key, so Auth rate-limits the
+   * refresh by the user's IP (when IP forwarding is on for the project).
+   */
+  readonly forwardedFor?: {
+    readonly ip: string;
+    readonly secretKey: string;
+  };
+  readonly fetch?: typeof fetch;
+  /**
+   * Milliseconds before a refresh counts as a network failure (the session is
+   * kept). 5000 by default.
+   */
+  readonly timeoutMs?: number;
+  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
+  readonly now?: () => number;
+}
+type RefreshOutcome = {
+  readonly ok: true;
+  readonly session: StoredSession;
+  /** Served from a concurrent or just-finished refresh of the same token. */
+  readonly shared?: boolean;
+} | {
+  readonly ok: false;
+  /** `rejected`: the refresh token is dead, sign the user out. `network`: keep the session and retry later. */
+  readonly reason: "rejected" | "network";
+  /** For `network`: the fetch failed, timed out, or Auth answered 5xx or 429. */
+  readonly cause?: "fetch" | "timeout" | "status";
+  readonly status?: number;
+  /** The Auth server's `error_code`, such as `user_banned` or `refresh_token_not_found`. */
+  readonly code?: string;
+  readonly message: string;
+};
+/**
+ * Exchanges a refresh token for a new session. Concurrent calls with the same
+ * token share one request, and a successful result is reused for a short
+ * window so parallel requests carrying the old cookie converge on one session.
+ */
+declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
+//#endregion
+//#region src/auth/context.d.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+declare function authContext(auth: AuthState): RequestContext;
+//#endregion
+//#region src/auth/ended.d.ts
+/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
+type SessionStatus = "active" | "ended" | "banned" | "unknown";
+interface SessionStatusOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  readonly cookieName?: string;
+  readonly fetch?: typeof fetch;
+  readonly timeoutMs?: number;
+  readonly now?: () => number;
+}
+interface ClearSessionCookiesOptions {
+  readonly url: string;
+  readonly cookieName?: string;
+  readonly cookie?: CookieOptions;
+}
+declare function sessionStatus(input: Request | string, options: SessionStatusOptions): Promise<SessionStatus>;
+declare function clearSessionCookies<R extends Response>(request: Request, response: R, options: ClearSessionCookiesOptions): R;
+//#endregion
+export { sessionStatus as a, RefreshOutcome as c, clearSessionCookies as i, refreshSession as l, SessionStatus as n, authContext as o, SessionStatusOptions as r, RefreshOptions as s, ClearSessionCookiesOptions as t };